Security as a process, not a state
Security is often perceived as a state: once set up - and you can forget about the topic. This mindset creates a false sense of completeness and reduces attention to one's own decisions over time.
In reality, security is a process. It does not depend on a one-time action, but on a sequence of decisions that are made again and again. The context changes, conditions become more complex, and old behavior models stop working as they used to.